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Listing of Claims 
Claims 1-21 (cancelled) 

Claim 22 (new) A method for identifying the existence of one or more unknown programs in a 
system having a memory, a processor, and a spy device, said method comprising the steps of: 

attempting to write a predetermined number of bits from a stream of bits to the memory 
in the system, wherein the predetermined number of bits is based on the size of the memory; 

reading from the memory a number of bits equal to the predetermined number of bits 
attempted to be written to the memory; 

determining if the bits read from the memory match the bits attempted to be written to the 
memory; and 

identifying by the spy device the existence of one more unknown programs if the read 
bits do not match the bits attempted to be written or if any of the bits attempted to be written to 
the memory are also being improperly transmitted to a storage or other device. 

Claim 23 (new) The method of claim 22 wherein the predetermined number of bits are in a 
known stream of bits from the spy device. 

Claim 24 (new) The method of claim 22 wherein the bits comprises a sequence of pseudorandom 
bits and wherein the number of bits to be written is equal to the expected size of the memory. 

Claim 25 (new) A method for advising a server transmitting a stream of bits for use by an 
application program in a client system that a virus may have entered the system, said method 
comprising the steps of 

receiving at the client system from a server a stream of bits for use by an application 
program at the client system; 

attempting to write a predetermined number of bits to a memory in the client system, 
wherein the predetermined number of bits is based on the size of the memory; 

reading from the memory a number of bits equal to the predetermined number of bits 
attempted to be written to the memory; 

determining if the bits read from the memory match the bits attempted to be written to the 
memory; 
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determining if any of the bits attempted to be written to the memory are also being 
improperly transmitted to a storage device or other device; 

determining that a virus may have entered the client system if either the bits read from the 
memory do not match the bits attempted to be written to the memory or if it is determined that 
any of the bits attempted to be written to the memory have also been improperly transmitted to a 
storage device or other device; and 

transmitting a message back to the server if it is determined that a virus may have entered 
the system. 

Claim 26 (new) A system for identifying the existence of one or more unknown programs in a 
client, said system comprising: 

apparatus that attempts to write a predetermined number of bits from a stream of bits 
transmitted to the client to a memory in the client, reads a number of bits from the memory that 
is equal to the predetermined number of bits attempted to be written to the memory, determines 
if the bits read from the memory match the bits attempted to be written to the memory, 
determines if any of the bits attempted to be written to the memory are being improperly 
transmitted to a storage device or other device, and identifies the existence of the one or more 
unknown programs if the bits read from memory do not match the bits attempted to be written to 
the memory or any of the bits attempted to be written to the memory have also been improperly 
transmitted to a storage or other device. 

Claim 27 (new) A computer system comprising: 

a processor; 

a memory; and 

a spy device, said spy device observing the computer systems internal operations to 
detect if a stream of bits transmitted to the computer system from a server have been improperly 
transmitted to a storage or other device within the computer system or transmitted back over the 
network to another computer system and, if so, alerting the server. 
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